OKHTTP · CVE-2026-129482 · Package
NO FIX YET · SEE WHAT TO DO
OkHttp's CertificatePinner skips pin checks when a hostname is written with a trailing dot, because Pin.matchesHostname does not normalize it. A network attacker holding a CA-trusted certificate for a different name can intercept or modify TLS traffic to pinned hosts.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use OkHttp with CertificatePinner configured and that request pinned hosts using the trailing-dot form. Apps without certificate pinning, or that never use a trailing-dot hostname, are not exposed by this flaw. unknown whether any other configuration widens exposure.
Not affected if no-certificate-pinning, no-trailing-dot-hostnames
Who cares android, java, kotlin, okhttp
okhttp in build.gradle or pom.xml) and compare it with the range through 5.5.1CertificatePinner to see whether certificate pinning is used at allOkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin checks because Pin.matchesHostname does not normalize trailing-dot hostnames. Network attackers with a CA-trusted certificate not matching configured pins can intercept or modify TLS traffic when applications request the trailing-dot form of pinned hosts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.